Firmware root of trust implementation system, method, computer device and storage medium

Abstract

The present application relates to a firmware root of trust implementation system, method, computer device, and storage medium. The system includes: a hardware layer and a software layer built on the hardware layer, the software layer including a user mode layer, an administrator mode layer, and a machine mode layer connected in sequence; wherein the hardware layer includes storage space, an execution architecture kernel, and a trusted root; the user mode layer includes an untrusted user application and a trusted execution environment module; the administrator mode layer includes an untrusted operating system, a trusted operating system, and a shared space; the untrusted operating system and the trusted operating system interact with each other through the shared space; the user mode layer is used to call the administrator mode layer to perform read and write operations on data in the storage space; the machine mode layer includes a security-critical component for receiving control instructions transmitted by the untrusted operating system and the trusted operating system and running the operating system kernel. The use of the above system can improve the reliability of the firmware root of trust implementation on the RISC‑V execution architecture.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a firmware trusted root implementation system, method, computer device, and storage medium. Background Art

[0002] A Trusted Execution Environment (TEE) provides hardware-enforced isolation within the processor, allowing applications to run in a separate execution area called an enclave. This aims to improve protection and defense against software vulnerability exploits. This ensures that even if a non-enclave system is compromised, attackers cannot access the user's critical assets running in the enclave. A recent trend in TEE development is the transition from dedicated TEEs controlled by a single vendor to open TEEs, allowing trusted applications (TAs) from multiple sources with diverse use cases to run within them. This transition has fostered a TA ecosystem, providing more robust and customized security protection for applications and a wide range of operating systems, such as Linux and Android. For example, firmware-based root of trust (fTPM) has become widely adopted in numerous servers and mobile devices. fTPM addresses the traditional hardware platform requirement where the TPM (root of trust) requires a discrete, dedicated module to be plugged into the platform to provide unrestricted TPM functionality. While TEEs are currently widely deployed, these underlying software systems or platform processors are mostly based on the ARM platform architecture. As more and more vendors plan to adopt the RISC-V architecture in their products, it is necessary to define a way for RISC-V architecture implementations to reuse the existing TA ecosystem. Summary of the Invention

[0003] Based on this, it is necessary to provide a firmware trusted root implementation system, method, computer device and storage medium that can improve the reliability of firmware trusted root implementation on the RISC-V execution architecture to address the above technical problems.

[0004] In order to solve the above technical problems, in a first aspect, a firmware root of trust implementation system is provided, the system comprising: a hardware layer and a software layer built on the hardware layer, the software layer comprising a user mode layer, an administrator mode layer, and a machine mode layer connected in sequence;

[0005] The hardware layer includes storage space, execution architecture core, and trusted root. The storage space is used to store persistent data of the firmware trusted root, and the execution architecture core is used to enforce storage space access permissions.

[0006] The user mode layer includes untrusted user applications and a trusted execution environment module. The user mode layer is used to execute applications;

[0007] The administrator mode layer includes an untrusted operating system, a trusted operating system, and a shared space. The untrusted operating system and the trusted operating system interact with each other through the shared space. The user mode layer is used to call the administrator mode layer to perform read and write operations on the data in the storage space.

[0008] The machine mode layer includes security-critical components, which are used to receive control instructions transmitted by the untrusted operating system and the trusted operating system, and run the operating system kernel according to the control instructions.

[0009] In one embodiment, a non-trusted user application and a non-trusted operating system are communicatively connected, and the non-trusted user application and the non-trusted operating system are located in a non-trusted execution environment. The non-trusted application includes a first user layer application, a second user layer application, and a software stack that are communicatively connected; the non-trusted operating system includes a first driver, a second driver, and a third driver that are communicatively connected.

[0010] In one embodiment, the trusted execution environment module and the trusted operating system are communicatively connected, the trusted execution environment module and the trusted operating system are located in the trusted execution environment, the trusted execution environment module includes a communicatively connected operation module and a fourth driver; the trusted operating system includes a communicatively connected fifth driver and an encryption module.

[0011] In one embodiment, the control instruction includes an interrupt processing instruction, and the security critical component is used to transmit the interrupt processing instruction and implement switching between the untrusted operating system and the trusted operating system according to the interrupt processing instruction.

[0012] In order to solve the above technical problems, a second aspect provides a firmware root of trust implementation method, which applies any of the above claims to the firmware root of trust implementation system, and the method includes:

[0013] In response to receiving an execution architecture power-on instruction, loading a hardware layer root of trust, verifying the trusted operating system firmware based on the root of trust, and obtaining a verification result;

[0014] If the verification result is successful, the trusted operating system file is loaded into the storage space for storage;

[0015] Loading the fifth driver and encryption module in the trusted operating system and setting up a shared space to enable the operation of the trusted operating system;

[0016] Perform firmware loading, and in response to the firmware being in the process of running, generate a sending instruction, and send the sending instruction to the trusted operating system to load the trusted execution environment module, so as to use the trusted operating system to run the application layer program of the trusted execution environment module;

[0017] Initialize the trusted execution environment module and create a firmware trusted root device for use by the firmware;

[0018] Release the trusted root instance through the firmware, run the untrusted operating system, and then load the first driver and the second driver to create a trusted root device for use by the user layer;

[0019] In response to receiving a specific instruction, the initialization of the internal logical data of the trusted root is triggered, and the user application is completed through the software stack of the non-trusted user application.

[0020] In one embodiment, the method further comprises:

[0021] In response to the trusted execution environment module being loaded, determining whether the non-volatile random access memory has been initialized;

[0022] If the non-volatile random access memory has not been initialized, the trusted execution environment module writes the data structure data according to a preset specification;

[0023] The data structure data is transmitted to the fifth driver of the trusted operating system via the fourth driver of the trusted execution environment module. The fifth driver uses the encryption module of the trusted operating system and the cryptographic accelerator provided by the execution architecture to encrypt the data structure data to obtain encrypted data, and saves the encrypted data to the shared space.

[0024] In response to receiving the data write operation instruction, an interrupt handling instruction is triggered, the trusted operating system sends the interrupt handling instruction, the data write operation instruction, and the data write address to the safety-critical component, the safety-critical component switches to the non-trusted operating system according to the interrupt handling instruction, and transmits the data write operation instruction and the data write address to the non-trusted operating system;

[0025] In response to the third driver of the non-trusted operating system receiving the data write operation instruction and the data write address, the third driver forwards the data write operation instruction and the data write address to the second user layer application via the first user layer application, the second user layer application reads the data in the storage space through the first driver, and writes the data corresponding to the data write operation instruction into the storage space;

[0026] In response to writing the data corresponding to the data write operation instruction into the storage space, the third driver sends an interrupt processing instruction to the safety-critical component, and the safety-critical component switches to the trusted operating system according to the interrupt processing instruction and transmits the initialization result of the non-volatile random access memory to the trusted execution environment module;

[0027] If the non-volatile random access memory has been initialized, a firmware root startup instruction is obtained, and the trusted root memory logic data is initialized according to the firmware root startup instruction to implement firmware trusted root data initialization;

[0028] In response to the completion of initialization of the firmware trusted root data, the second driver of the untrusted operating system creates a trusted root device.

[0029] In one embodiment, in response to the second driver receiving the trusted root device operation instruction sent by the software stack, the second driver sends an interrupt processing instruction and the trusted root device operation instruction to the security critical component, and the security critical component switches to the trusted operating system according to the interrupt processing instruction and transmits the trusted root device operation instruction to the trusted operating system;

[0030] In response to the trusted operating system receiving the trusted root device operation instruction, the trusted root operating system parses the trusted root device operation instruction to obtain a parsing result, and sends the trusted root device operation instruction to the operation module in the trusted execution environment module according to the parsing result, and the operation module of the trusted execution environment module performs the trusted root device operation according to the trusted root device operation instruction.

[0031] In one embodiment, the operation module of the trusted execution environment module performs the trusted root device operation according to the trusted root device operation instruction, including:

[0032] Parse the trusted root device operation instruction, obtain the trusted root device operation type, and determine whether the trusted root device operation includes data read and write operations;

[0033] If the trusted root device operation includes a data read and write operation, the operation module calls the fifth driver to perform the data read and write operation on the storage space;

[0034] If the data read / write operation type is a data read operation, an interrupt processing instruction is generated and transmitted to the safety-critical component. The safety-critical component switches to the non-trusted operating system according to the interrupt processing instruction and transmits the data read operation instruction to the non-trusted operating system. The non-trusted operating system reads the data in the storage space and stores the read data in the shared memory.

[0035] If the data read and write operation type is a data write operation, the data is encrypted through the encryption module to obtain the encrypted data, and the encrypted data is written into the shared space, an interrupt processing instruction is generated, and the interrupt processing instruction is transmitted to the security-critical component. The security-critical component switches to the non-trusted operating system according to the interrupt processing instruction and transmits the data write operation instruction and the encrypted data to the non-trusted operating system. The trusted operating system transmits the data write operation instruction and the encrypted data to the non-trusted operating system, and the encrypted data is written into the storage space through the non-trusted operating system.

[0036] In order to solve the above technical problems, in the third aspect, a computer device is provided, including a memory, a processor and a computer program stored in the memory and runnable on the processor, and the processor implements the following steps when executing the computer program: the processor implements the steps of the above-mentioned first aspect method when executing the computer program.

[0037] In order to solve the above technical problems, in a fourth aspect, the present application provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method of the above first aspect are implemented.

[0038] Different from the existing technology, the present application provides a firmware trusted root implementation system, the system includes: a hardware layer and a software layer built on the hardware layer, the software layer includes a user mode layer, an administrator mode layer and a machine mode layer connected in sequence; wherein, the hardware layer includes storage space, an execution architecture core and a trusted root, the storage space is used to store persistent data of the firmware trusted root, and the execution architecture core is used to execute storage space access permissions; the user mode layer includes a non-trusted user application and a trusted execution environment module, and the user mode layer is used to execute the application; the administrator mode layer includes a non-trusted operating system, a trusted operating system and a shared space, and the non-trusted operating system and the trusted operating system interact with data through the shared space; the user mode layer is used to call the administrator mode layer to perform read and write operations on data in the storage space; the machine mode layer includes security-critical components, and the security-critical components are used to receive control instructions transmitted by the non-trusted operating system and the trusted operating system, and run the operating system kernel according to the control instructions. In this way, applications and operating systems in trusted execution environments and non-trusted execution environments are set up in the privileged user mode layer, administrator mode layer and machine mode layer of the RSIC-V execution architecture, data interaction between the trusted execution environment and the non-trusted execution environment is achieved through memory space, and control instructions transmitted by the non-trusted operating system and the trusted operating system are received through security-critical components, and the operating system kernel is run according to the control instructions, which can improve the reliability of the firmware trusted root implementation. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A structural block diagram of a firmware root of trust implementation system in the prior art;

[0040] Figure 2 A structural block diagram of a firmware root of trust implementation system in one embodiment;

[0041] Figure 3 1 is a flow chart of a method for implementing a firmware root of trust in one embodiment;

[0042] Figure 4 1 is a flow chart of a method for implementing a firmware root of trust in another embodiment;

[0043] Figure 5 1 is a flowchart of a method for implementing a firmware root of trust in another embodiment;

[0044] Figure 6 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0046] In addition to conventional standalone chip solutions soldered onto the motherboard, CPU vendors are also integrating trusted computing features into their processors. For example, Intel introduced Platform Trust Technology (PTT), which implements TPM (root of trust) functionality within the system firmware. AMD's Ryzen Pro CPUs have built-in TPM functionality. Another technical solution is to use firmware TPM (fTPM), which is a pure software TPM that runs only within the CPU's Trusted Execution Environment (TEE). Another option is virtual TPM (vTPM).

[0047] Under the ARMv8 architecture, the existing technology fTPM (firmware trusted root) is a TA (Trust Application) running TEEOS (Trusted Operating System), and the implementation method is as follows: Figure 1 ARM platform firmware root of trust implementation architecture diagram, Figure 1 In the implementation of fTPM, an fTPM TA (fTPM Trust Application) is implemented in TEEOS to realize the computing function of TPM, and RPMB or rich OS FS file system is used as the trusted storage of fTPM in Rich OS (operating system). The secure storage function of TEE (Trusted Execution Environment) is used to store the TPM's persistent data in this secure and encrypted RPMB or Rich OS fs in a shared memory read-write mode. The interaction between the FTPM driver on the REE side and the FTPM TA on the TEE side is handled by ARM's SMC instruction, which is switched to the secure world by the EL3 firmware layer and forwarded to the TEE OS to the FTPM TA application. This interaction process is a kind of interaction mode, and other modes are forwarding, thereby ensuring security.

[0048] Although the existing technology is relatively convenient, its implementation is based on the ARM platform or other architecture platforms and cannot be applied to the RISC-V architecture platform. All of the above technical logic cannot be reused on RSIC-V.

[0049] In order to solve the above technical problems, in one embodiment, Figure 2 As shown, the present application provides a firmware trusted root implementation system, which includes a hardware layer and a software layer built on the hardware layer. The software layer includes a user mode layer, an administrator mode layer and a machine mode layer connected in sequence.

[0050] Specifically, the execution architecture used in this application is RSIC-V. The RSIC-V execution architecture has three privileged modes in terms of the operating system, wherein the three privileged modes include a user mode layer, an administrator mode layer, and a machine mode layer.

[0051] The machine mode layer (shown as m-mode) is the highest privileged mode in the RISC-V architecture and the mode in which the operating system kernel runs. In m-mode, the operating system has full control and can access all resources and registers, including physical memory, devices, and peripherals. M-mode is typically used for operating system booting and initialization, as well as handling exceptions and interrupts.

[0052] Supervisor mode (shown as s-mode) is the second-highest privileged mode in the RISC-V architecture, used to run the operating system kernel. In s-mode, the operating system can access restricted resources and registers, but cannot directly access physical memory and devices. s-mode is typically used for core operating system functions such as process management, memory management, and device drivers.

[0053] The user mode layer (u-mode in the figure) is the least privileged mode in the RISC-V architecture. It cannot access hardware resources and can only access certain registers and general instructions. It is generally used to point to applications.

[0054] m-mode and s-mode are two privileged modes in the RISC-V architecture, used to implement operating system privilege levels and resource access control. Their existence can improve system security and stability, and also facilitate operating system development and debugging.

[0055] Among them, the hardware layer includes storage space, execution architecture core and trusted root. The storage space is used to store persistent data of the firmware trusted root, and the execution architecture core is used to execute storage space access permissions.

[0056] Specifically, the Silicon Root of Trust (Silicon Root of Trust), as the first element of the trust chain, maintains the confidentiality, integrity, and authenticity of sensitive or privileged computing and data. It is implemented through a combination of software, hardware, and cryptographic isolation technologies, and generally appears in the form of a certificate provided by the manufacturer to ensure the trust of the implementation.

[0057] The physical memory protection (PMP) provided by the execution architecture core (RSIC-V Core) is part of the RISC-V privileged architecture specification. It describes the interface of a standard RISC-V memory protection unit. PMP defines a limited set of PMP regions that can be individually configured to enforce access permissions within a memory address range, thereby achieving physical isolation of the trusted execution environment.

[0058] The secure storage space is used as the persistent storage space of the TPM (root of trust) to store the persistent data of the FTPM (firmware root of trust), such as initialization data and NVRAM data.

[0059] The user mode layer includes non-trusted user applications and a trusted execution environment module. The user mode layer is used to execute applications. The administrator mode layer includes a non-trusted operating system, a trusted operating system, and a shared space. The non-trusted operating system and the trusted operating system interact with each other through the shared space. The user mode layer is used to call the administrator mode layer to perform read and write operations on data in the storage space.

[0060] Specifically, see Figure 2 , the non-trusted user application and the non-trusted operating system are communicatively connected, the non-trusted user application and the non-trusted operating system are located in a non-trusted execution environment, the non-trusted application includes a first user layer application, a second user layer application and a software stack that are communicatively connected; the non-trusted operating system includes a first driver, a second driver and a third driver that are communicatively connected.

[0061] The trusted execution environment module and the trusted operating system are communicatively connected. The trusted execution environment module and the trusted operating system are located in the trusted execution environment. The trusted execution environment module includes a communicatively connected operation module and a fourth driver; the trusted operating system includes a communicatively connected fifth driver and an encryption module.

[0062] Specifically, the trusted execution environment (ftpm TA) implements the logical implementation defined by the trusted platform module through the operation module (tpm lib), that is, defines the logical implementation of the trusted root. The fourth driver can be a storage driver. The fourth driver is used for the storage function of persistent data. This driver will forward the read and write operations that require persistent data to the fifth driver in the trusted operating system. The fifth driver can also be a storage driver. It is forwarded to the third driver and the first user layer application and the second application layer application in the non-trusted space through the security-critical component. The second application layer application calls the first driver in the non-trusted execution environment. The first driver can be a storage driver. The storage space is read and written through the first driver. In the process of data transmission, the data to be read and written will be encrypted and stored in the shared space, thereby realizing data transmission.

[0063] The operation module of the trusted execution environment defines and implements the functional logic defined by the TPM specification.

[0064] The fourth driver of the trusted execution environment implements the persistent storage required by TPM, especially the reading and writing of NVRAM, and forwards instructions and data.

[0065] The fifth driver of the trusted execution environment processes the TPM persistent data read and write instructions and saves the data in a shared space after encryption. The interrupt processing instructions and data operation instructions defined by SBI can be transmitted to the security-critical components. The security-critical components switch to the non-trusted execution environment according to the interrupt processing instructions and forward the data operation instructions to the non-trusted execution environment to read and write the storage space.

[0066] The Trusted Execution Environment's cryptographic module, powered by RSIC-V, provides hardware acceleration for asymmetric encryption and decryption, signing, and signature verification. It supports RSA and ECC using prime curves, symmetric encryption and decryption, all common block cipher modes, hashing, symmetric signing and signature verification using HMAC, symmetric and asymmetric key generation, and random number generation for random numbers, key generation, and signing.

[0067] In one embodiment, the encryption module may include a key generator, a key storage, a key manager, and a key cache. The key generator is responsible for generating, detecting, selecting, and creating various keys for the trusted computing module. The key storage is a critical infrastructure component of the cryptographic coprocessor, and data in the key storage must be encrypted and stored. The key manager is the core of the cryptographic coprocessor and serves as the gateway to all operations, including key management and key transmission. The key cache manages key segments within the data protection key and the hierarchical keys protected by the storage root key, thereby improving system reliability.

[0068] The non-trusted execution environment operating system (OS / firmware in the figure) can be an operating system similar to Linux or BSD, or it can be similar to BIOS, uboot, UEFI firmware, etc.

[0069] The third driver of the non-trusted execution environment is responsible for functions such as generating and forwarding instructions or interrupts that interact with the trusted execution environment.

[0070] The second driver of the non-trusted execution environment is responsible for registering and initializing the trusted platform module device, receiving TPM operations from the user layer, and forwarding TPM operations to the third driver.

[0071] The first driver of the non-trusted execution environment is responsible for receiving the read and write operations of the storage space of the user layer and implementing the read and write functions.

[0072] The second user layer application of the non-trusted execution environment belongs to the non-trusted execution environment user layer application, which is responsible for data reading and writing, and decryption and reading and writing of shared memory.

[0073] The first user layer application of the non-trusted execution environment belongs to the non-trusted execution environment user layer application, and is responsible for receiving and sending tee instructions.

[0074] In this application, by setting up a trusted execution environment in the user mode layer, administrator mode layer and machine mode layer of the RSIC-V execution architecture and data interaction between applications and operating systems in the non-trusted execution environment, the operating system in the non-trusted execution environment can provide ftpm functions to users; and realize communication between a secure trusted execution environment and a non-secure non-trusted execution environment.

[0075] The machine mode layer includes safety-critical components such as Figure 1 As shown, the security-critical component is connected to the non-trusted operating system and the trusted operating system for communication. The security-critical component is used to receive control instructions transmitted by the non-trusted operating system and the trusted operating system, and run the operating system kernel according to the control instructions.

[0076] The security-critical component (Secure Monitor) can achieve interrupt isolation by switching the PLIC interrupt enable mode, realize the context switching between the trusted execution environment and the non-trusted execution environment, and forward instructions between the trusted execution environment and the non-trusted execution environment.

[0077] In one embodiment, the control instruction may be an interrupt handling instruction. The SBI shown in the figure is an interrupt handling instruction used for switching between a feasible execution environment and a non-trusted execution environment. The SMC instruction shown in the figure is an interrupt or exception handling instruction used for switching between a trusted environment and a non-trusted execution environment. The present application integrates a driver for the firmware trusted root in the operating system. The driver sends and receives instructions to the firmware trusted root and switches contexts by calling the interface provided by the SBI, rather than sending and receiving instructions through a physical trusted root register, thereby improving the reliability of execution environment switching.

[0078] This application utilizes the existing TEE support for RISC-V and, in a trusted execution environment, leverages the spatial isolation and information flow control features of the trusted execution environment to design and implement an ftpm TA application to implement the functions defined by the trusted platform module. The logical implementation includes key generation, storage and encryption of key usage, software authentication, remote authentication, etc. A driver module for ftpm persistence operations is added to the TEE OS. In a non-trusted execution environment, a firmware trusted root driver and a data read and write driver for firmware trusted root persistence data are designed and implemented. To ensure data interaction, shared memory is added.

[0079] In one embodiment, Figure 3 As shown, a firmware trusted root implementation method is provided, which is applied to Figure 1 The firmware root of trust implementation system in the example is used as an example to illustrate the process, which includes the following steps:

[0080] Step 101 : In response to receiving an execution architecture power-on instruction, loading a hardware layer root of trust, and verifying the trusted operating system firmware according to the root of trust to obtain a verification result.

[0081] Step 102: If the verification result is successful, the trusted operating system file is loaded into the storage space for storage.

[0082] Step 103 : Load the fifth driver and encryption module in the trusted operating system, and set a shared space to enable the operation of the trusted operating system.

[0083] Specifically, in response to receiving the power-on instruction of the execution architecture (RISC-V) device, the hardware layer's trusted root will be loaded first. The trusted root usually appears in the form of a certificate provided by the manufacturer to ensure the trust of the implementation and serve as the trusted root of trusted startup; after completing the loading of the trusted root, continue to load and start the hardware-related drivers. During the startup process, the trusted operating system will be verified using the trusted root. After the verification is passed, the trusted operating system file will be loaded into the designated memory area set by PMP, that is, the storage space. This memory area is an isolated area, and other programs have no permission to read, write, or execute. Further, the trusted operating system is started, and the fifth driver of the trusted operating system and the encryption module in the trusted operating system are loaded, and a shared space is set for data interaction between the non-trusted execution environment and the trusted execution environment. At this time, the trusted operating system becomes a trusted operating system running independently in a trusted execution space.

[0084] Step 104 , loading the firmware. In response to the firmware being in operation, generating a sending instruction, and sending the sending instruction to the trusted operating system to load the trusted execution environment module, so as to utilize the trusted operating system to run the application layer program of the trusted execution environment module.

[0085] Step 105: Initialize the trusted execution environment module and create a firmware trusted root device for use by the firmware.

[0086] Step 106: Release the trusted root instance through the firmware, run the untrusted operating system, and then load the first driver and the second driver to simultaneously create a trusted root device for use by the user layer.

[0087] Specifically, after setting up the trusted operating system, firmware loading can be performed. For example, it can be uboot, uefi or bios firmware model loading and running, running the third driver, the first user layer application, the second user layer application and loading the first driver, etc.; during the firmware running process, it will load and send instructions to the trusted operating system to load the trusted execution environment module, and the trusted operating system will run the trusted user layer program in the trusted execution environment module.

[0088] Step 107 , in response to receiving a specific instruction, triggering the initialization of the internal logical data of the trusted root, and completing the user application through the software stack of the non-trusted user application.

[0089] Specifically, the trusted execution environment module can be loaded and instantiated, and initialization operations can be performed to create a firmware-based trusted root device for use by the firmware. During the initialization process, data in the storage space will be read. If it has not been initialized, the secure storage will be initialized.

[0090] The initialization process is to send initialization instructions through the software stack in the non-trusted operating system, and the operation module in the firmware trusted root determines the format and content of the data, and writes it into the shared memory after encryption through the fourth driver in the trusted execution environment, and sends the operation instructions by the security-critical component to the first user-layer application in the non-trusted execution environment, and the second user-layer application is then written into the storage space by the first driver in the non-trusted execution environment; and the operation of reading data is also to send instructions for reading by the software stack in the non-trusted operating system, and the operation module of the trusted execution environment module determines the data kernel and format to be read, and then forwards the operation instructions to the third driver in the non-trusted execution environment through the security-critical component, the third driver forwards the operation instructions to the first user-layer application, and then reads the data in the storage space through the second user-layer application and saves it in the shared space. The trusted execution environment module then reads the data in the shared space and decrypts it to complete the data reading.

[0091] It can be understood that the firmware trusted root is similar to the physical trusted root. Specific instructions (such as the TPM2_Startup instruction in the TPM2.0 chip and the TCM_Startup instruction in the TCM chip) are required to trigger the initialization of the internal logical data of the trusted root and complete the initialization of the internal data of the firmware trusted root. After successful initialization, the trusted root can operate normally and can be applied, such as implementing secure boot based on the trusted root.

[0092] Furthermore, the firmware releases the trusted root instance and loads the operating system. During the operating system startup process, the second driver and the first driver are loaded, and a trusted root device (such as / dev / tpm0) is created for use by the user layer. During this process, the firmware trusted root is reloaded and the trusted root device is started. For example, during the initialization of the firmware trusted root in the firmware, the firmware trusted root operating state is configured based on the firmware trusted root state data, and the persistent data stored by the user in the firmware trusted root is loaded.

[0093] like Figure 4 As shown, the firmware trusted root initialization process of this application is as follows:

[0094] S10: In response to the trusted execution environment module (Ftpm TA in the figure) being loaded, it is determined whether the non-volatile random access memory has been initialized (the initialization state is obtained).

[0095] S20: If the non-volatile random access memory has not been initialized, the trusted execution environment module writes the data structure data according to a preset specification.

[0096] Specifically, after loading, the TEE can check whether the NVRAM (non-volatile random access memory) has been initialized. If not, NVRAM initialization needs to be implemented in the storage space. The TEE module can initiate the NVRAM initialization instruction, and the operating module in the TEE then processes the data structure and data to be written according to the trusted root specification defined by the operating module.

[0097] S201: The data structure data is transmitted to the fifth driver of the trusted operating system via the fourth driver of the trusted execution environment module. The fifth driver uses the encryption module of the trusted operating system and the cryptographic accelerator provided by the execution architecture to encrypt the data structure data, obtain the encrypted data, and save the encrypted data to the shared space.

[0098] S202: In response to receiving the data write operation instruction, the interrupt handling instruction is triggered, and the trusted operating system sends the interrupt handling instruction, the data write operation instruction and the data write address to the security-critical component. The security-critical component switches to the non-trusted operating system according to the interrupt handling instruction, and transmits the data write operation instruction and the data write address to the non-trusted operating system.

[0099] S203: In response to the third driver of the non-trusted operating system receiving the data write operation instruction and the data write address, the data write operation instruction and the data write address are forwarded to the second user layer application via the first user layer application. The second user layer application reads the data in the storage space through the first driver and writes the data corresponding to the data write operation instruction into the storage space.

[0100] S204: In response to writing the data corresponding to the data write operation instruction into the storage space, the third driver sends an interrupt processing instruction to the security-critical component. The security-critical component switches to the trusted operating system according to the interrupt processing instruction and transmits the initialization result of the non-volatile random access memory to the trusted execution environment module.

[0101] Specifically, to initialize NVRAM, it is first necessary to obtain the nvram initialization instruction initiated by the trusted execution environment module, and send the data structure data to the fifth driver of the trusted operating system kernel layer through the fourth driver of the trusted execution environment; the fifth driver will use the encryption module and the cryptographic accelerator provided by the RSIC-V execution architecture to encrypt the data, and then the fifth driver of the kernel layer will save the encrypted data in the shared space.

[0102] In one embodiment, for data write operations, the trusted operating system transmits the instructions and data memory address and size to be written via SBI by the security-critical component by interrupting the operating system's usage rights, switching between trusted and non-trusted contexts, and reaches the third driver in the non-trusted execution environment; after receiving the signal, the third driver forwards the data to the first user layer application in the user layer for processing, and the first user layer application will hand over the specific read and write transactions to the second user layer application; the second user layer application reads the data in the shared space through the first driver in the non-trusted execution environment and writes it to the storage space; after the data is written to the storage space, the third driver sends an SBI instruction to the security-critical component, and the security-critical component switches to the trusted operating system according to the interrupt processing instruction and transmits the initialization result of the storage space to the trusted operating system, and the trusted operating system then transmits the initialization result of the storage space to the trusted execution environment module.

[0103] S21: If the non-volatile random access memory has been initialized, a firmware root startup instruction is obtained, and the trusted root memory logic data is initialized according to the firmware root startup instruction to implement firmware trusted root data initialization (firmware trusted root startup instruction).

[0104] S22: In response to the completion of initialization of the firmware trusted root data, the second driver of the non-trusted operating system creates a trusted root device (create trusted root device).

[0105] If the storage space has been initialized before, or the operation of initializing the storage space has been completed, the firmware root startup instruction can be obtained, and the trusted root memory logical data can be initialized according to the firmware root startup instruction to realize the firmware trusted root data initialization, and then create a trusted root device for use by the user layer.

[0106] The firmware trusted root startup of this application is similar to the physical trusted root. It requires specific instructions (such as the TPM2_Startup instruction in the TPM2.0 chip and the TCM_Startup instruction in the TCM chip) to trigger the initialization of the internal logical data of the trusted root and complete the initialization of the internal data of the firmware trusted root. This process involves reading and writing nvram and persistent data. The writing process is consistent with the initialization process of nvram, except that the data structure passed is different. The process of reading persistent data is as follows:

[0107] A read operation instruction is sent by the trusted execution environment module, specifically, the operation module operating in the trusted execution environment module sends the read operation instruction to the fifth driver, and the fifth driver sends the read operation instruction to the third driver of the non-trusted execution environment through the security-critical component; the third driver receives the data read operation instruction, forwards the data read operation instruction to the second user layer application via the first user layer application, and the second user layer application reads the data in the shared space through the first driver, and stores the data corresponding to the data read operation instruction in the shared storage.

[0108] After the non-trusted execution environment stores the data corresponding to the read operation instruction in the shared storage, it triggers a signal interrupt instruction and switches to the trusted execution environment through the security-critical component. The fifth driver in the trusted operating system reads the data in the shared tea space, decrypts it using the encryption module, and then sends the decrypted data to the fourth driver and operation module in the user space of the trusted execution environment, and returns the result to the trusted execution environment module to complete the reading of the persistent data.

[0109] After device initialization is complete, a trusted root device (such as / dev / tpm0) is created in the non-trusted execution environment by loading the operating module. The software stack uses the trusted root device, and the second driver is responsible for processing instructions, forwarding them to the trusted execution environment for specific logic. This prevents ordinary programs from tampering with the data, thereby improving the reliability of the firmware's trusted root implementation.

[0110] In one embodiment, see Figure 5 In one embodiment, in response to the second driver receiving the trusted root device operation instruction sent by the software stack, the second driver sends an interrupt processing instruction and the trusted root device operation instruction to the security critical component, and the security critical component switches to the trusted operating system according to the interrupt processing instruction, and transmits the trusted root device operation instruction to the trusted operating system; in response to the trusted operating system receiving the trusted root device operation instruction, the trusted root operating system parses the trusted root device operation instruction to obtain a parsing result, and sends the trusted root device operation instruction to the operation module in the trusted execution environment module according to the parsing result, and the operation module of the trusted execution environment module performs the trusted root device operation according to the trusted root device operation instruction.

[0111] Specifically, the non-trusted operating system or firmware uses the software stack to execute the trusted root operation command; the software stack will operate the trusted root device, and then interact with the kernel layer, that is, the non-trusted operating system, through IOCTl; the second driver of the non-trusted operating system will receive the trusted root operation instruction passed from the user layer and will send the SBI instruction to call the trusted execution environment module through the third driver; after receiving the SBI instruction, an interrupt processing instruction will be generated. When the key security component receives the instruction and interrupt signal, it will save the context of the non-trusted execution environment and switch the context to the trusted execution environment for execution; the trusted operating system will determine which TA the information sent by the security-critical component is for. If it is for the firmware trusted root, it will be forwarded to the trusted execution environment module; the trusted execution environment module will receive the information, determine the specific trusted root instruction, that is, whether it is a data read instruction or a data write instruction, and hand it over to the execution module to implement the specific logical function.

[0112] In one embodiment, the operation module of the trusted execution environment module performs the trusted root device operation according to the trusted root device operation instruction, including:

[0113] Parse the trusted root device operation instruction, obtain the trusted root device operation type, and determine whether the trusted root device operation includes data read and write operations;

[0114] If the trusted root device operation includes a data read and write operation, the operation module calls the fifth driver to perform the data read and write operation on the storage space;

[0115] If the data read / write operation type is a data read operation, an interrupt processing instruction is generated and transmitted to the safety-critical component. The safety-critical component switches to the non-trusted operating system according to the interrupt processing instruction and transmits the data read operation instruction to the non-trusted operating system. The non-trusted operating system reads the data in the storage space and stores the read data in the shared memory.

[0116] If the data read and write operation type is a data write operation, the data is encrypted through the encryption module to obtain the encrypted data, and the encrypted data is written into the shared space, an interrupt processing instruction is generated, and the interrupt processing instruction is transmitted to the security-critical component. The security-critical component switches to the non-trusted operating system according to the interrupt processing instruction and transmits the data write operation instruction and the encrypted data to the non-trusted operating system. The trusted operating system transmits the data write operation instruction and the encrypted data to the non-trusted operating system, and the encrypted data is written into the storage space through the non-trusted operating system.

[0117] Specifically, first, the operation module of the trusted execution environment module receives the information and determines whether the trusted root device operation includes data reading and writing operations; if it does not involve data reading and writing operations on the storage space, the result is delivered to the trusted execution environment module, and the trusted execution environment module sends the result to the trusted operating system; if it involves data reading and writing operations on the storage space, the operation module calls the fourth driver to perform data reading and writing operations on the storage space; if the data reading and writing operation type is a data reading operation, an interrupt processing instruction is generated, and the interrupt processing instruction is transmitted to the security-critical component. The security-critical component switches to the non-trusted operating system according to the interrupt processing instruction and transmits the data reading operation instruction to the non-trusted operating system, reads the data in the storage space through the non-trusted operating system and stores the read data in the shared memory.

[0118] If the data read and write operation type is a data write operation, the data is encrypted through the encryption module to obtain the encrypted data, and the encrypted data is written into the shared space, an interrupt processing instruction is generated, and the interrupt processing instruction is transmitted to the security-critical component. The security-critical component switches to the non-trusted operating system according to the interrupt processing instruction and transmits the data write operation instruction and the encrypted data to the non-trusted operating system. The trusted operating system transmits the data write operation instruction and the encrypted data to the non-trusted operating system, and the encrypted data is written into the storage space through the non-trusted operating system.

[0119] After the data read and write operations are completed, the results are returned to the first user layer application and the second user layer application. The first user layer application returns the results to the third driver. The third driver sends the SBI instruction again. After receiving the SBI instruction, an interrupt processing instruction is generated. After the key security component receives the instruction and the interrupt signal, it saves the context of the non-trusted execution environment, switches the context to the trusted execution environment for execution, and returns the result to the operation module through the fifth driver and the fourth driver in turn; the operation module completes the specific logic implementation and then hands it over to the trusted execution environment module. The trusted execution environment module sends an instruction to return the result to the trusted operating system. The trusted operating system sends the SBI instruction again. After receiving the SBI instruction, the security-critical component switches to the non-trusted execution environment for operation, and returns the final processing result to the software stack and the user through the third driver, the second driver and the trusted root device of the non-trusted operating system.

[0120] This application also provides a root of trust functionality to the operating system through a pure software implementation. The firmware root of trust runs in a trusted execution environment independent of the operating system, preventing ordinary programs from tampering with the data within it. Furthermore, the operation module uses the encryption and decryption hardware acceleration provided by RSIC-V to increase the speed of trusted computing. Therefore, compared with virtual root of trust or software-implemented root of trust, this method is more secure.

[0121] It should be understood that although Figure 3-Figure 5 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. In addition, Figure 3-Figure 5 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0122] For the specific definition of the firmware root of trust implementation system, please refer to the definition of the firmware root of trust implementation method above and will not be repeated here. Each module in the above-mentioned firmware root of trust implementation system can be implemented in whole or in part through software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each of the above modules.

[0123] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a firmware trusted root implementation method is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad provided on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0124] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0125] In one embodiment, the present application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the firmware trusted root implementation method provided by the above methods.

[0126] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are performed:

[0127] Step 101 : In response to receiving an execution architecture power-on instruction, loading a hardware layer root of trust, and verifying the trusted operating system firmware according to the root of trust to obtain a verification result.

[0128] Step 102: If the verification result is successful, the trusted operating system file is loaded into the storage space for storage.

[0129] Step 103 : Load the fifth driver and encryption module in the trusted operating system, and set a shared space to enable the operation of the trusted operating system.

[0130] Step 104 , loading the firmware. In response to the firmware being in operation, generating a sending instruction, and sending the sending instruction to the trusted operating system to load the trusted execution environment module, so as to utilize the trusted operating system to run the application layer program of the trusted execution environment module.

[0131] Step 105: Initialize the trusted execution environment module and create a firmware trusted root device for use by the firmware.

[0132] Step 106: Release the trusted root instance through the firmware, run the untrusted operating system, and then load the first driver and the second driver to simultaneously create a trusted root device for use by the user layer.

[0133] Step 107 , in response to receiving a specific instruction, triggering the initialization of the internal logical data of the trusted root, and completing the user application through the software stack of the non-trusted user application.

[0134] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0135] In response to the trusted execution environment module being loaded, determining whether the non-volatile random access memory has been initialized;

[0136] If the non-volatile random access memory has not been initialized, the trusted execution environment module writes the data structure data according to a preset specification;

[0137] The data structure data is transmitted to the fifth driver of the trusted operating system via the fourth driver of the trusted execution environment module. The fifth driver uses the encryption module of the trusted operating system and the cryptographic accelerator provided by the execution architecture to encrypt the data structure data to obtain encrypted data, and saves the encrypted data to the shared space.

[0138] In response to receiving the data write operation instruction, an interrupt handling instruction is triggered, the trusted operating system sends the interrupt handling instruction, the data write operation instruction, and the data write address to the safety-critical component, the safety-critical component switches to the non-trusted operating system according to the interrupt handling instruction, and transmits the data write operation instruction and the data write address to the non-trusted operating system;

[0139] In response to the third driver of the non-trusted operating system receiving the data write operation instruction and the data write address, the third driver forwards the data write operation instruction and the data write address to the second user layer application via the first user layer application, the second user layer application reads the data in the storage space through the first driver, and writes the data corresponding to the data write operation instruction into the storage space;

[0140] In response to writing the data corresponding to the data write operation instruction into the storage space, the third driver sends an interrupt processing instruction to the safety-critical component, and the safety-critical component switches to the trusted operating system according to the interrupt processing instruction and transmits the initialization result of the non-volatile random access memory to the trusted execution environment module;

[0141] If the non-volatile random access memory has been initialized, a firmware root startup instruction is obtained, and the trusted root memory logic data is initialized according to the firmware root startup instruction to implement firmware trusted root data initialization;

[0142] In response to the completion of initialization of the firmware trusted root data, the second driver of the untrusted operating system creates a trusted root device.

[0143] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0144] In response to the second driver receiving the trusted root device operation instruction sent by the software stack, the second driver sends an interrupt processing instruction and the trusted root device operation instruction to the safety-critical component, and the safety-critical component switches to the trusted operating system according to the interrupt processing instruction and transmits the trusted root device operation instruction to the trusted operating system;

[0145] In response to the trusted operating system receiving the trusted root device operation instruction, the trusted root operating system parses the trusted root device operation instruction to obtain a parsing result, and sends the trusted root device operation instruction to the operation module in the trusted execution environment module according to the parsing result, and the operation module of the trusted execution environment module performs the trusted root device operation according to the trusted root device operation instruction.

[0146] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0147] The operation module of the trusted execution environment module performs the trusted root device operation according to the trusted root device operation instruction, including:

[0148] Parse the trusted root device operation instruction, obtain the trusted root device operation type, and determine whether the trusted root device operation includes data read and write operations;

[0149] If the trusted root device operation includes a data read and write operation, the operation module calls the fifth driver to perform the data read and write operation on the storage space;

[0150] If the data read / write operation type is a data read operation, an interrupt processing instruction is generated and transmitted to the safety-critical component. The safety-critical component switches to the non-trusted operating system according to the interrupt processing instruction and transmits the data read operation instruction to the non-trusted operating system. The non-trusted operating system reads the data in the storage space and stores the read data in the shared memory.

[0151] If the data read and write operation type is a data write operation, the data is encrypted through the encryption module to obtain the encrypted data, and the encrypted data is written into the shared space, an interrupt processing instruction is generated, and the interrupt processing instruction is transmitted to the security-critical component. The security-critical component switches to the non-trusted operating system according to the interrupt processing instruction and transmits the data write operation instruction and the encrypted data to the non-trusted operating system. The trusted operating system transmits the data write operation instruction and the encrypted data to the non-trusted operating system, and the encrypted data is written into the storage space through the non-trusted operating system.

[0152] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0153] Step 101 : In response to receiving an execution architecture power-on instruction, loading a hardware layer root of trust, and verifying the trusted operating system firmware according to the root of trust to obtain a verification result.

[0154] Step 102: If the verification result is successful, the trusted operating system file is loaded into the storage space for storage.

[0155] Step 103 : Load the fifth driver and encryption module in the trusted operating system, and set a shared space to enable the operation of the trusted operating system.

[0156] Step 104 , loading the firmware. In response to the firmware being in operation, generating a sending instruction, and sending the sending instruction to the trusted operating system to load the trusted execution environment module, so as to utilize the trusted operating system to run the application layer program of the trusted execution environment module.

[0157] Step 105: Initialize the trusted execution environment module and create a firmware trusted root device for use by the firmware.

[0158] Step 106: Release the trusted root instance through the firmware, run the untrusted operating system, and then load the first driver and the second driver to simultaneously create a trusted root device for use by the user layer.

[0159] Step 107 , in response to receiving a specific instruction, triggering the initialization of the internal logical data of the trusted root, and completing the user application through the software stack of the non-trusted user application.

[0160] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0161] In response to the trusted execution environment module being loaded, determining whether the non-volatile random access memory has been initialized;

[0162] If the non-volatile random access memory has not been initialized, the trusted execution environment module writes the data structure data according to a preset specification;

[0163] The data structure data is transmitted to the fifth driver of the trusted operating system via the fourth driver of the trusted execution environment module. The fifth driver uses the encryption module of the trusted operating system and the cryptographic accelerator provided by the execution architecture to encrypt the data structure data to obtain encrypted data, and saves the encrypted data to the shared space.

[0164] In response to receiving the data write operation instruction, an interrupt handling instruction is triggered, the trusted operating system sends the interrupt handling instruction, the data write operation instruction, and the data write address to the safety-critical component, the safety-critical component switches to the non-trusted operating system according to the interrupt handling instruction, and transmits the data write operation instruction and the data write address to the non-trusted operating system;

[0165] In response to the third driver of the non-trusted operating system receiving the data write operation instruction and the data write address, the third driver forwards the data write operation instruction and the data write address to the second user layer application via the first user layer application, the second user layer application reads the data in the storage space through the first driver, and writes the data corresponding to the data write operation instruction into the storage space;

[0166] In response to writing the data corresponding to the data write operation instruction into the storage space, the third driver sends an interrupt processing instruction to the safety-critical component, and the safety-critical component switches to the trusted operating system according to the interrupt processing instruction and transmits the initialization result of the non-volatile random access memory to the trusted execution environment module;

[0167] If the non-volatile random access memory has been initialized, a firmware root startup instruction is obtained, and the trusted root memory logic data is initialized according to the firmware root startup instruction to implement firmware trusted root data initialization;

[0168] In response to the completion of initialization of the firmware trusted root data, the second driver of the untrusted operating system creates a trusted root device.

[0169] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0170] In response to the second driver receiving the trusted root device operation instruction sent by the software stack, the second driver sends an interrupt processing instruction and the trusted root device operation instruction to the safety-critical component, and the safety-critical component switches to the trusted operating system according to the interrupt processing instruction and transmits the trusted root device operation instruction to the trusted operating system;

[0171] In response to the trusted operating system receiving the trusted root device operation instruction, the trusted root operating system parses the trusted root device operation instruction to obtain a parsing result, and sends the trusted root device operation instruction to the operation module in the trusted execution environment module according to the parsing result, and the operation module of the trusted execution environment module performs the trusted root device operation according to the trusted root device operation instruction.

[0172] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0173] The operation module of the trusted execution environment module performs the trusted root device operation according to the trusted root device operation instruction, including:

[0174] Parse the trusted root device operation instruction, obtain the trusted root device operation type, and determine whether the trusted root device operation includes data read and write operations;

[0175] If the trusted root device operation includes a data read and write operation, the operation module calls the fifth driver to perform the data read and write operation on the storage space;

[0176] If the data read / write operation type is a data read operation, an interrupt processing instruction is generated and transmitted to the safety-critical component. The safety-critical component switches to the non-trusted operating system according to the interrupt processing instruction and transmits the data read operation instruction to the non-trusted operating system. The non-trusted operating system reads the data in the storage space and stores the read data in the shared memory.

[0177] If the data read and write operation type is a data write operation, the data is encrypted through the encryption module to obtain the encrypted data, and the encrypted data is written into the shared space, an interrupt processing instruction is generated, and the interrupt processing instruction is transmitted to the security-critical component. The security-critical component switches to the non-trusted operating system according to the interrupt processing instruction and transmits the data write operation instruction and the encrypted data to the non-trusted operating system. The trusted operating system transmits the data write operation instruction and the encrypted data to the non-trusted operating system, and the encrypted data is written into the storage space through the non-trusted operating system.

[0178] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0179] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0180] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A firmware root of trust implementation system, characterized in that: include: A hardware layer and a software layer built on the hardware layer, wherein the software layer includes a user mode layer, an administrator mode layer, and a machine mode layer connected in sequence; The hardware layer includes a storage space, an execution architecture core, and a trusted root. The storage space is used to store persistent data of the firmware trusted root, and the execution architecture core is used to enforce storage space access permissions. The user mode layer includes an untrusted user application and a trusted execution environment module, and the user mode layer is used to execute the application; The administrator mode layer includes an untrusted operating system, a trusted operating system, and a shared space, and the untrusted operating system and the trusted operating system interact with each other through the shared space; the user mode layer is used to call the administrator mode layer to perform read and write operations on data in the storage space; The machine mode layer includes a security-critical component, which is used to receive control instructions transmitted by the untrusted operating system and the trusted operating system, and run the operating system kernel according to the control instructions.

2. The system according to claim 1, wherein: The non-trusted user application and the non-trusted operating system are communicatively connected, and the non-trusted user application and the non-trusted operating system are located in a non-trusted execution environment. The non-trusted application includes a first user layer application, a second user layer application and a software stack that are communicatively connected; the non-trusted operating system includes a first driver, a second driver and a third driver that are communicatively connected.

3. The system according to claim 1, wherein: The trusted execution environment module and the trusted operating system are communicatively connected, and the trusted execution environment module and the trusted operating system are located in a trusted execution environment. The trusted execution environment module includes a communicatively connected operation module and a fourth driver; the trusted operating system includes a communicatively connected fifth driver and an encryption module.

4. The system according to claim 1, wherein: The control instruction includes an interrupt processing instruction. The safety-critical component is used to transmit the interrupt processing instruction and implement the switching between the untrusted operating system and the trusted operating system according to the interrupt processing instruction.

5. A firmware root of trust implementation method, based on the firmware root of trust implementation system according to any one of claims 1 to 4, characterized in that: The method comprises: In response to receiving an execution architecture power-on instruction, loading a hardware layer root of trust, and verifying the trusted operating system firmware according to the root of trust to obtain a verification result; If the verification result is successful, the trusted operating system file is loaded into the storage space for storage; Loading the fifth driver and encryption module in the trusted operating system and setting up a shared space to enable the operation of the trusted operating system; Performing firmware loading, generating a sending instruction in response to the firmware being in the running process, and sending the sending instruction to the trusted operating system to load the trusted execution environment module, so as to use the trusted operating system to run the application layer program of the trusted execution environment module; Initialize the trusted execution environment module to create a firmware trusted root device for use by the firmware; Release the trusted root instance through the firmware, run the untrusted operating system, and then load the first driver and the second driver to create a trusted root device for use by the user layer; In response to receiving a specific instruction, the initialization of the internal logical data of the trusted root is triggered, and the user application is completed through the software stack of the non-trusted user application.

6. The method according to claim 5, characterized in that The method further comprises: In response to the trusted execution environment module being loaded, determining whether the non-volatile random access memory has been initialized; If the non-volatile random access memory has not been initialized, the trusted execution environment module writes the data structure data according to a preset specification; The data structure data is transmitted to a fifth driver of the trusted operating system via a fourth driver of the trusted execution environment module. The fifth driver encrypts the data structure data using an encryption module of the trusted operating system and a cryptographic accelerator provided by the execution architecture to obtain encrypted data, and saves the encrypted data to a shared space. In response to receiving the data write operation instruction, an interrupt handling instruction is triggered, the trusted operating system sends the interrupt handling instruction, the data write operation instruction, and the data write address to the safety-critical component, the safety-critical component switches to the non-trusted operating system according to the interrupt handling instruction, and transmits the data write operation instruction and the data write address to the non-trusted operating system; In response to the third driver of the untrusted operating system receiving the data write operation instruction and the data write address, the third driver forwards the data write operation instruction and the data write address to the second user layer application via the first user layer application, the second user layer application reads the data in the storage space through the first driver, and writes the data corresponding to the data write operation instruction into the storage space; In response to writing the data corresponding to the data write operation instruction into the storage space, the third driver sends an interrupt processing instruction to the safety-critical component, and the safety-critical component switches to the trusted operating system according to the interrupt processing instruction and transmits the initialization result of the non-volatile random access memory to the trusted execution environment module; If the non-volatile random access memory has been initialized, obtaining a firmware root startup instruction, and initializing the trusted root memory logic data according to the firmware root startup instruction to implement firmware trusted root data initialization; In response to completion of initialization of the firmware trusted root data, the second driver of the untrusted operating system creates a trusted root device.

7. The method according to claim 5, characterized in that The method further comprises: In response to the second driver receiving the trusted root device operation instruction sent by the software stack, the second driver sends an interrupt handling instruction and the trusted root device operation instruction to the security critical component, the security critical component switches to the trusted operating system according to the interrupt handling instruction, and transmits the trusted root device operation instruction to the trusted operating system; In response to the trusted operating system receiving the trusted root device operation instruction, the trusted root operating system parses the trusted root device operation instruction to obtain a parsing result, and sends the trusted root device operation instruction to the operation module in the trusted execution environment module according to the parsing result, and the operation module of the trusted execution environment module performs the trusted root device operation according to the trusted root device operation instruction.

8. The method according to claim 7, characterized in that The operation module of the trusted execution environment module performs the trusted root device operation according to the trusted root device operation instruction, including: Parsing the trusted root device operation instruction to obtain the trusted root device operation type, and determining whether the trusted root device operation includes a data read and write operation; If the trusted root device operation includes a data read and write operation, the operation module calls a fifth driver to perform a data read and write operation on the storage space; If the data read / write operation type is a data read operation, an interrupt handling instruction is generated and transmitted to the security-critical component. The security-critical component switches to the non-trusted operating system according to the interrupt handling instruction and transmits the data read operation instruction to the non-trusted operating system. The non-trusted operating system reads the data in the storage space and stores the read data in the shared memory. If the data read and write operation type is a data write operation, the data is encrypted through the encryption module to obtain the encrypted data, and the encrypted data is written into the shared space, an interrupt processing instruction is generated, and the interrupt processing instruction is transmitted to the security-critical component. The security-critical component switches to the non-trusted operating system according to the interrupt processing instruction and transmits the data write operation instruction and the encrypted data to the non-trusted operating system. The trusted operating system transmits the data write operation instruction and the encrypted data to the non-trusted operating system, and the encrypted data is written into the storage space through the non-trusted operating system.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 5 to 8 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 5 to 8 are implemented.

Images